npm - @openparachute/hub - Versions diffs - 0.5.10-rc.6 → 0.5.10 - Mend

@openparachute/hub 0.5.10-rc.6 → 0.5.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (51) hide show

package/package.json +1 -1
package/src/__tests__/admin-handlers.test.ts +141 -6
package/src/__tests__/api-account.test.ts +463 -0
package/src/__tests__/api-modules-ops.test.ts +139 -0
package/src/__tests__/api-modules.test.ts +134 -0
package/src/__tests__/api-users.test.ts +522 -0
package/src/__tests__/cors.test.ts +587 -0
package/src/__tests__/hub-db.test.ts +126 -1
package/src/__tests__/hub-server.test.ts +29 -4
package/src/__tests__/hub-settings.test.ts +377 -0
package/src/__tests__/hub.test.ts +17 -0
package/src/__tests__/jwt-sign.test.ts +59 -0
package/src/__tests__/oauth-handlers.test.ts +1059 -10
package/src/__tests__/oauth-ui.test.ts +210 -0
package/src/__tests__/scope-explanations.test.ts +23 -0
package/src/__tests__/serve.test.ts +8 -1
package/src/__tests__/setup-wizard.test.ts +1500 -13
package/src/__tests__/supervisor.test.ts +76 -2
package/src/__tests__/users.test.ts +196 -0
package/src/__tests__/vault-name.test.ts +79 -0
package/src/__tests__/vault-names.test.ts +172 -0
package/src/account-change-password-ui.ts +379 -0
package/src/admin-handlers.ts +68 -2
package/src/admin-host-admin-token.ts +5 -0
package/src/admin-vault-admin-token.ts +7 -0
package/src/api-account.ts +443 -0
package/src/api-mint-token.ts +6 -0
package/src/api-modules-ops.ts +30 -6
package/src/api-modules.ts +101 -0
package/src/api-users.ts +393 -0
package/src/commands/auth.ts +10 -1
package/src/commands/serve.ts +5 -1
package/src/cors.ts +263 -0
package/src/hub-db.ts +54 -0
package/src/hub-server.ts +162 -18
package/src/hub-settings.ts +259 -0
package/src/hub.ts +34 -9
package/src/jwt-sign.ts +17 -1
package/src/oauth-handlers.ts +256 -29
package/src/oauth-ui.ts +451 -38
package/src/operator-token.ts +4 -0
package/src/scope-explanations.ts +26 -1
package/src/setup-wizard.ts +1100 -56
package/src/supervisor.ts +66 -14
package/src/users.ts +210 -3
package/src/vault-name.ts +71 -0
package/src/vault-names.ts +57 -0
package/web/ui/dist/assets/index-XhxYXDT5.js +61 -0
package/web/ui/dist/assets/{index-D54otIhv.css → index-p6DkOcsk.css} +1 -1
package/web/ui/dist/index.html +2 -2
package/web/ui/dist/assets/index-AX_UHJ5e.js +0 -61

package/src/account-change-password-ui.ts ADDED Viewed

@@ -0,0 +1,379 @@
+/**
+ * Server-rendered HTML for `/account/change-password` — the user's
+ * self-service password rotation surface, and the landing page for the
+ * force-change-password redirect from `/login` (multi-user Phase 1 PR 3,
+ * design 2026-05-20-multi-user-phase-1.md §sign-in flow change).
+ *
+ * Two modes share the page:
+ *
+ *  - **first-time login** (`mode: "first-time"`): the just-logged-in user
+ *    has `password_changed: false`. Heading reads "First-time login: please
+ *    choose a new password" and the page explains why the redirect fired
+ *    (the admin typed the default; you should pick your own).
+ *  - **rotate** (`mode: "rotate"`): a signed-in user navigated here on
+ *    their own to change their password. Heading reads "Change your
+ *    password" — no force-redirect framing.
+ *
+ * The handler decides which mode to render at request time by reading
+ * the user's `passwordChanged` flag; this file is the pure renderer.
+ *
+ * Same chrome family as `admin-login-ui.ts` (`/login`) — inline CSS,
+ * no third-party fonts, no SPA bundle. The page works without JS;
+ * client-side validation is a fast-feedback layer on top of the server-
+ * side `validatePassword` + match-confirm + current-≠-new checks.
+ */
+import { renderCsrfHiddenInput } from "./csrf.ts";
+import { escapeHtml } from "./oauth-ui.ts";
+import { PASSWORD_MIN_LEN } from "./users.ts";
+// --- shared chrome --------------------------------------------------------
+//
+// Palette + font stack mirror `admin-login-ui.ts` so the change-password
+// surface visually belongs to the same "Parachute pre-auth + thin-auth"
+// surface family as /login. A small Phase-2 polish opportunity is to
+// extract this into a shared `auth-ui-chrome.ts`; for now duplication is
+// cheap and keeps the surfaces independently editable.
+const PALETTE = {
+  bg: "#faf8f4",
+  bgSoft: "#f3f0ea",
+  fg: "#2c2a26",
+  fgMuted: "#6b6860",
+  fgDim: "#9a9690",
+  accent: "#4a7c59",
+  accentHover: "#3d6849",
+  accentSoft: "rgba(74, 124, 89, 0.08)",
+  border: "#e4e0d8",
+  borderLight: "#ece9e2",
+  cardBg: "#ffffff",
+  danger: "#a3392b",
+  dangerSoft: "rgba(163, 57, 43, 0.08)",
+  success: "#3d6849",
+  successSoft: "rgba(61, 104, 73, 0.08)",
+} as const;
+const FONT_SERIF = `Georgia, "Times New Roman", serif`;
+const FONT_SANS = `-apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif`;
+const FONT_MONO = `ui-monospace, "SF Mono", Menlo, Monaco, "Cascadia Mono", monospace`;
+function escapeAttr(s: string): string {
+  return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+}
+function baseDocument(title: string, body: string): string {
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>${escapeHtml(title)}</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta name="referrer" content="no-referrer" />
+  <style>${STYLES}</style>
+</head>
+<body>
+  <main>
+${body}
+  </main>
+</body>
+</html>`;
+}
+function header(): string {
+  return `
+        <div class="brand">
+          <span class="brand-mark">⌬</span>
+          <span class="brand-name">Parachute</span>
+          <span class="brand-tag">account</span>
+        </div>`;
+}
+// --- /account/change-password ---------------------------------------------
+export type ChangePasswordMode = "first-time" | "rotate";
+export interface RenderChangePasswordProps {
+  mode: ChangePasswordMode;
+  csrfToken: string;
+  /** The signed-in user's display name (for the "signed in as <X>" line). */
+  username: string;
+  /** Where the POST handler should redirect on success (same-origin path). */
+  next: string;
+  /** Inline error to surface above the form after a failed POST. */
+  errorMessage?: string;
+  // NOTE: unused in Phase 1 (POST always redirects on success). Reserved
+  // for Phase 2 self-service profile flow that may rotate-in-place and
+  // re-render with a success banner.
+  /** Render a success banner — used by the rotate flow when the user
+   *  re-renders the form after a successful change (Phase 2; for now
+   *  the POST success path always redirects so this never fires). */
+  successMessage?: string;
+}
+export function renderChangePassword(props: RenderChangePasswordProps): string {
+  const { mode, csrfToken, username, next, errorMessage, successMessage } = props;
+  const error = errorMessage ? `<p class="error-banner">${escapeHtml(errorMessage)}</p>` : "";
+  const success = successMessage
+    ? `<p class="success-banner">${escapeHtml(successMessage)}</p>`
+    : "";
+  const title =
+    mode === "first-time" ? "First-time login: choose a new password" : "Change your password";
+  const subtitle =
+    mode === "first-time"
+      ? "An admin set a default password for your account. Please pick your own before continuing — only you should know it."
+      : "Pick a new password for your account.";
+  const body = `
+    <div class="card">
+      <div class="card-header">
+        ${header()}
+        <h1>${escapeHtml(title)}</h1>
+        <p class="subtitle">${escapeHtml(subtitle)}</p>
+        <p class="signed-in">Signed in as <strong>${escapeHtml(username)}</strong>.</p>
+      </div>
+      ${success}
+      ${error}
+      <form method="POST" action="/account/change-password" class="auth-form" id="change-form">
+        ${renderCsrfHiddenInput(csrfToken)}
+        <input type="hidden" name="next" value="${escapeAttr(next)}" />
+        <label class="field">
+          <span class="field-label">Current password</span>
+          <input type="password" name="current_password" autocomplete="current-password"
+            autofocus required />
+        </label>
+        <label class="field">
+          <span class="field-label">New password</span>
+          <input type="password" name="new_password" autocomplete="new-password"
+            required minlength="${PASSWORD_MIN_LEN}" id="new-password" />
+          <span class="field-hint">at least ${PASSWORD_MIN_LEN} characters — a passphrase is fine</span>
+        </label>
+        <label class="field">
+          <span class="field-label">Confirm new password</span>
+          <input type="password" name="new_password_confirm" autocomplete="new-password"
+            required minlength="${PASSWORD_MIN_LEN}" id="new-password-confirm" />
+          <span class="field-hint" id="confirm-hint"></span>
+        </label>
+        <button type="submit" class="btn btn-primary">Change password</button>
+      </form>
+    </div>
+    <script>${CLIENT_VALIDATION_JS}</script>`;
+  const pageTitle =
+    mode === "first-time" ? "First-time login — Parachute" : "Change password — Parachute";
+  return baseDocument(pageTitle, body);
+}
+// --- client-side validation -----------------------------------------------
+//
+// Fast-feedback only — the server-side handler is the authority. Mirrors
+// the three server checks: minimum length, new === confirm, current ≠ new.
+// Without JS the form posts normally and the server re-renders with an
+// inline error message; with JS the user sees "passwords don't match" or
+// "new password must differ from current" inline before submitting.
+const CLIENT_VALIDATION_JS = `
+(function () {
+  var form = document.getElementById("change-form");
+  if (!form) return;
+  var newPw = document.getElementById("new-password");
+  var confirm = document.getElementById("new-password-confirm");
+  var current = form.querySelector('input[name="current_password"]');
+  var hint = document.getElementById("confirm-hint");
+  function check() {
+    if (!hint) return;
+    if (!confirm || !newPw || !current) return;
+    if (confirm.value.length === 0) { hint.textContent = ""; return; }
+    if (confirm.value !== newPw.value) {
+      hint.textContent = "Passwords do not match";
+      hint.style.color = "${PALETTE.danger}";
+    } else if (current.value.length > 0 && current.value === newPw.value) {
+      hint.textContent = "New password must differ from current";
+      hint.style.color = "${PALETTE.danger}";
+    } else {
+      hint.textContent = "Passwords match";
+      hint.style.color = "${PALETTE.success}";
+    }
+  }
+  if (newPw) newPw.addEventListener("input", check);
+  if (confirm) confirm.addEventListener("input", check);
+  if (current) current.addEventListener("input", check);
+  form.addEventListener("submit", function (e) {
+    if (!newPw || !confirm || !current) return;
+    if (newPw.value !== confirm.value) {
+      e.preventDefault();
+      if (hint) {
+        hint.textContent = "Passwords do not match";
+        hint.style.color = "${PALETTE.danger}";
+      }
+      return;
+    }
+    if (current.value === newPw.value) {
+      e.preventDefault();
+      if (hint) {
+        hint.textContent = "New password must differ from current";
+        hint.style.color = "${PALETTE.danger}";
+      }
+      return;
+    }
+  });
+})();
+`;
+// --- styles ---------------------------------------------------------------
+//
+// Mirrors `admin-login-ui.ts` STYLES. If/when a shared `auth-ui-chrome.ts`
+// lands these two should merge.
+const STYLES = `
+  *, *::before, *::after { box-sizing: border-box; }
+  html, body { margin: 0; padding: 0; }
+  body {
+    font-family: ${FONT_SANS};
+    background: ${PALETTE.bg};
+    color: ${PALETTE.fg};
+    line-height: 1.55;
+    min-height: 100vh;
+    -webkit-font-smoothing: antialiased;
+    -moz-osx-font-smoothing: grayscale;
+  }
+  main {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    min-height: 100vh;
+    padding: 1.5rem;
+  }
+  .card {
+    width: 100%;
+    max-width: 30rem;
+    background: ${PALETTE.cardBg};
+    border: 1px solid ${PALETTE.border};
+    border-radius: 12px;
+    padding: 2rem 1.75rem;
+    box-shadow: 0 1px 2px rgba(44, 42, 38, 0.04), 0 8px 24px rgba(44, 42, 38, 0.06);
+  }
+  .card-header { margin-bottom: 1.5rem; }
+  .brand {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    color: ${PALETTE.accent};
+    font-weight: 500;
+    font-size: 0.95rem;
+    margin-bottom: 1.25rem;
+  }
+  .brand-mark { font-size: 1.1rem; line-height: 1; }
+  .brand-name { letter-spacing: 0.01em; }
+  .brand-tag {
+    text-transform: uppercase;
+    letter-spacing: 0.06em;
+    font-size: 0.7rem;
+    color: ${PALETTE.fgMuted};
+    border: 1px solid ${PALETTE.borderLight};
+    padding: 0.05rem 0.4rem;
+    border-radius: 999px;
+  }
+  h1 {
+    font-family: ${FONT_SERIF};
+    font-weight: 400;
+    font-size: 1.6rem;
+    line-height: 1.2;
+    margin: 0 0 0.4rem;
+    color: ${PALETTE.fg};
+  }
+  .subtitle { margin: 0; color: ${PALETTE.fgMuted}; font-size: 0.95rem; }
+  .signed-in {
+    margin: 0.75rem 0 0;
+    color: ${PALETTE.fgMuted};
+    font-size: 0.85rem;
+    font-family: ${FONT_MONO};
+  }
+  .signed-in strong { color: ${PALETTE.fg}; font-weight: 500; }
+  .auth-form { display: flex; flex-direction: column; gap: 0.9rem; }
+  .field { display: flex; flex-direction: column; gap: 0.35rem; }
+  .field-label {
+    font-size: 0.85rem;
+    font-weight: 500;
+    color: ${PALETTE.fgMuted};
+    letter-spacing: 0.01em;
+    font-family: ${FONT_MONO};
+  }
+  .field-hint {
+    font-size: 0.78rem;
+    color: ${PALETTE.fgMuted};
+    font-family: ${FONT_MONO};
+  }
+  input[type=text], input[type=password] {
+    font: inherit;
+    width: 100%;
+    padding: 0.6rem 0.75rem;
+    border: 1px solid ${PALETTE.border};
+    border-radius: 6px;
+    background: ${PALETTE.bg};
+    color: ${PALETTE.fg};
+    transition: border-color 0.15s ease, background 0.15s ease;
+  }
+  input[type=text]:focus, input[type=password]:focus {
+    outline: none;
+    border-color: ${PALETTE.accent};
+    background: ${PALETTE.cardBg};
+    box-shadow: 0 0 0 3px ${PALETTE.accentSoft};
+  }
+  .btn {
+    font: inherit;
+    font-weight: 500;
+    padding: 0.65rem 1.25rem;
+    border-radius: 6px;
+    border: 1px solid transparent;
+    cursor: pointer;
+    transition: background 0.15s ease, color 0.15s ease, border-color 0.15s ease;
+    min-height: 2.5rem;
+  }
+  .btn-primary {
+    background: ${PALETTE.accent};
+    color: ${PALETTE.cardBg};
+    margin-top: 0.4rem;
+  }
+  .btn-primary:hover { background: ${PALETTE.accentHover}; }
+  .error-banner {
+    background: ${PALETTE.dangerSoft};
+    border: 1px solid ${PALETTE.danger};
+    border-radius: 6px;
+    color: ${PALETTE.danger};
+    padding: 0.6rem 0.8rem;
+    margin: 0 0 1rem;
+    font-size: 0.9rem;
+  }
+  .success-banner {
+    background: ${PALETTE.successSoft};
+    border: 1px solid ${PALETTE.success};
+    border-radius: 6px;
+    color: ${PALETTE.success};
+    padding: 0.6rem 0.8rem;
+    margin: 0 0 1rem;
+    font-size: 0.9rem;
+  }
+  @media (max-width: 480px) {
+    main { padding: 0.75rem; }
+    .card { padding: 1.5rem 1.25rem; border-radius: 10px; }
+    h1 { font-size: 1.4rem; }
+  }
+  @media (prefers-color-scheme: dark) {
+    body { background: #1a1815; color: #e8e4dc; }
+    .card { background: #25221d; border-color: #3a362f; box-shadow: 0 8px 24px rgba(0, 0, 0, 0.3); }
+    h1 { color: #f0ece4; }
+    .subtitle, .field-label, .field-hint, .signed-in { color: #a8a29a; }
+    .signed-in strong { color: #f0ece4; }
+    input[type=text], input[type=password] {
+      background: #1f1c18; border-color: #3a362f; color: #e8e4dc;
+    }
+    input[type=text]:focus, input[type=password]:focus {
+      background: #25221d;
+    }
+    .brand-tag { border-color: #3a362f; color: #a8a29a; }
+  }
+`;

package/src/admin-handlers.ts CHANGED Viewed

@@ -23,7 +23,7 @@ import {
   deleteSession,
   parseSessionCookie,
 } from "./sessions.ts";
-import { getUserByUsername, verifyPassword } from "./users.ts";
+import { PASSWORD_MAX_LEN, type User, getUserByUsername, verifyPassword } from "./users.ts";
 function htmlResponse(body: string, status = 200, extra: Record<string, string> = {}): Response {
   return new Response(body, {
@@ -44,6 +44,22 @@ function redirect(location: string, extra: Record<string, string> = {}): Respons
  */
 const POST_LOGIN_DEFAULT = "/admin/vaults";
+/**
+ * Force-change-password landing. Multi-user Phase 1 PR 3: when a user
+ * signs in with `password_changed === false` (admin-created account
+ * with the admin's default password), the login POST 302s here instead
+ * of `next`. The original `next` rides along as a query param so the
+ * change-password POST can land them at their intended destination
+ * after they pick a new password.
+ *
+ * Session-level redirect, not token-level — the cookie is minted as
+ * normal; only the redirect target changes. The user IS signed in,
+ * they're just expected to change their password before doing anything
+ * else (the `/account/change-password` page is reachable, the SPA
+ * isn't gated). Design §sign-in flow change.
+ */
+const FORCE_CHANGE_PASSWORD_PATH = "/account/change-password";
 function safeNext(raw: string | null): string {
   if (!raw) return POST_LOGIN_DEFAULT;
   // Only allow same-origin paths — never honor an absolute URL or scheme.
@@ -51,6 +67,32 @@ function safeNext(raw: string | null): string {
   return raw;
 }
+/**
+ * Pick the post-login redirect target for a freshly-authenticated user.
+ *
+ * **The only place `password_changed` gates a flow.** Per design §sign-
+ * in flow change, force-change is a session-level redirect at the login
+ * boundary — once changed, no per-request scope check is needed and
+ * no token claim carries the bit forward.
+ *
+ * When `password_changed === false`:
+ *   - redirect to `/account/change-password`
+ *   - preserve the user's intended `next` as a query param so the
+ *     change-password POST can finish the trip
+ *
+ * When `password_changed === true`: return `next` (today's behavior).
+ */
+export function loginRedirectTarget(user: User, next: string): string {
+  if (user.passwordChanged) return next;
+  // Preserve the operator's intended destination; the change-password
+  // POST will read this and 302 there after the change lands.
+  // Only encode `next` if it isn't already the post-change default —
+  // keeps the URL clean for the common case (no `next` param specified
+  // at login time → no `?next=` on the change-password URL).
+  if (next === POST_LOGIN_DEFAULT) return FORCE_CHANGE_PASSWORD_PATH;
+  return `${FORCE_CHANGE_PASSWORD_PATH}?next=${encodeURIComponent(next)}`;
+}
 // --- /login ---------------------------------------------------------------
 //
 // Renamed from `/admin/login` so the surface name reflects what it is — the
@@ -110,6 +152,22 @@ export async function handleAdminLoginPost(
       400,
     );
   }
+  // Cap incoming password length BEFORE getUserByUsername / argon2id
+  // verify touches it. An unauthenticated POST submitting a megabyte
+  // password would otherwise force a full argon2id hash on arbitrary
+  // input — CPU-DoS shape. 413 fires before any DB or hash work; same
+  // `PASSWORD_MAX_LEN` constant `/api/users` and `/account/change-
+  // password` use (PR-3 fold N1: applied uniformly across the auth
+  // surface family).
+  if (password.length > PASSWORD_MAX_LEN) {
+    return htmlResponse(
+      renderAdminError({
+        title: "Password too long",
+        message: `Password must be ≤ ${PASSWORD_MAX_LEN} characters.`,
+      }),
+      413,
+    );
+  }
   const user = getUserByUsername(db, username);
   if (!user) {
     return htmlResponse(
@@ -128,7 +186,15 @@ export async function handleAdminLoginPost(
   const cookie = buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000), {
     secure: isHttpsRequest(req),
   });
-  return redirect(next, { "set-cookie": cookie });
+  // Multi-user Phase 1 PR 3 — `password_changed === false` (admin-created
+  // user, hasn't picked their own password yet) lands at
+  // `/account/change-password` instead of `next`. The session cookie is
+  // minted as normal — the user IS authenticated, they're just expected
+  // to change the admin-typed default before continuing. Their original
+  // `next` rides along on the change-password URL so the post-change
+  // POST can land them at their intended destination.
+  const target = loginRedirectTarget(user, next);
+  return redirect(target, { "set-cookie": cookie });
 }
 /**

package/src/admin-host-admin-token.ts CHANGED Viewed

@@ -71,6 +71,11 @@ export async function handleHostAdminToken(
     clientId: HOST_ADMIN_CLIENT_ID,
     issuer: deps.issuer,
     ttlSeconds: HOST_ADMIN_TOKEN_TTL_SECONDS,
+    // Host-admin tokens carry no per-user vault pin — the SPA Bearer talks
+    // to hub-scoped admin endpoints (vaults, grants, users, tokens), not to
+    // a single vault. Empty `vault_scope` is the "no per-user restriction"
+    // sentinel matching admin OAuth tokens.
+    vaultScope: [],
   });
   return new Response(
     JSON.stringify({

package/src/admin-vault-admin-token.ts CHANGED Viewed

@@ -73,6 +73,13 @@ export async function handleVaultAdminToken(
     clientId: VAULT_ADMIN_CLIENT_ID,
     issuer: deps.issuer,
     ttlSeconds: VAULT_ADMIN_TOKEN_TTL_SECONDS,
+    // The session-cookie path mints a per-vault admin Bearer for an operator
+    // who is already authenticated as an admin (post-#199 SPA path). The
+    // token names exactly one vault in its `scope`; the `vault_scope` claim
+    // mirrors that so PR 5's scope-guard side sees the same explicit pin
+    // (rather than the empty-admin sentinel that would otherwise undermine
+    // the per-vault narrowing).
+    vaultScope: [vaultName],
   });
   return new Response(
     JSON.stringify({